CVE-2026-113322 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in Dawn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as a memory corruption issue within the Dawn graphics engine of Google Chrome prior to version 156.0.8078.47 represents a significant security risk that enables remote attackers to bypass sandboxing mechanisms and access protected memory regions. Dawn serves as the primary implementation of WebGL and WebGPU in Chromium-based browsers, translating high-level web graphics APIs into native GPU commands for various hardware backends including Vulkan, Metal, Direct3D, and OpenGL ES. The flaw resides within this critical rendering subsystem, where improper handling of specific graphical operations or shader programs can lead to memory safety violations such as buffer overflows or use-after-free conditions. Because Dawn operates with elevated privileges relative to the standard browser renderer process to facilitate direct hardware access for performance reasons, any corruption in its state management or resource allocation logic poses a severe threat to the overall security architecture of the browser environment.
The operational impact of this vulnerability is particularly concerning due to the potential for out-of-bounds memory reads within the sandboxed context. Typically, Chrome employs a multi-process architecture where each tab runs in an isolated renderer process with restricted permissions, preventing malicious code from accessing sensitive data such as cookies, passwords, or other site-specific information stored by the browser. However, when a crafted HTML page triggers this specific memory corruption flaw in Dawn, it allows for arbitrary read access to adjacent memory locations that should remain inaccessible under normal sandboxing rules. This capability effectively neutralizes one of the primary defense layers against exploitation, as an attacker can potentially exfiltrate sensitive data from other processes or internal browser structures without triggering immediate detection mechanisms associated with more obvious crashes or segmentation faults.
From a classification perspective, this vulnerability aligns closely with CWE-120 Buffer Copy without Checking Size of Input and CWE-787 Out-of-bounds Read, which are fundamental categories of memory corruption vulnerabilities often exploited in complex software systems like web browsers. The attack vector is classified under MITRE ATT&CK technique T1203 Exploitation for Client Execution, specifically leveraging the browser's rendering engine to execute malicious logic upon user interaction with a compromised or attacker-controlled webpage. This method relies on social engineering elements where users are lured into visiting specially crafted web content that triggers the vulnerability during normal browsing activities such as loading images, playing videos, or interacting with WebGL-based applications. The high severity rating assigned by Chromium security teams reflects the ease of exploitation and the significant privilege escalation potential inherent in bypassing sandbox restrictions through graphics engine flaws.
Mitigation strategies for this vulnerability primarily involve immediate software updates to ensure that all instances of Google Chrome are upgraded to version 156.0.8078.47 or later, where these memory safety issues have been addressed by the development team. For organizations managing large fleets of devices, automated patch management systems should be configured to prioritize browser security updates due to their high exposure surface area and frequent targeting by threat actors. Additionally, users can employ defense-in-depth measures such as enabling site isolation features which further restrict cross-origin data access even if sandbox boundaries are partially compromised. Security teams should also monitor for indicators of compromise related to unusual memory usage patterns or unexpected network connections originating from browser processes, although modern endpoint detection and response solutions may not always distinguish between legitimate graphics processing activity and malicious exploitation attempts without specific behavioral analytics tuned for browser-based attacks.